In my industry of cyber security, people who take this approach of exploring security problems and then disclosing them
responsibly are rewarded. Often financially, almost always with a public thanks and recognition of their contribution. They never get kicked out. I am a strong advocate of it, and think it is really positive for cyber security and in this case anti-cheating.
But the actions of this researcher don't quite pass as "responsible disclosure". He cheated in a race. He's been banned for cheating in a race. He tried to mitigate it by entering a TT, but he still crossed a red-line of cheating in a race. Zwift have to maintain that red-line and must be seen to ban anyone who cheats in a race.
I do have sympathy for him and I hope Zwift overturn the ban, but he could (and should) have demonstrated this weakness in a meet-up or in a free-ride session.
The problem is that responsible disclosure relies on a contract between vendor and researcher where the researcher agrees not to cross certain red lines (e.g cheating in a race, even as a test), and gives the vendor reasonable time to fix issues. In return, the vendor typically agrees to resolve issues promptly (usually with a published timeline) and allows the researcher to share their findings publicly once the issue is fixed. It works well, but it relies on the terms being publicly available and an acknowledgement of the "rules" in advance.
Zwift don't have a security disclosure policy - it would help both the community and Zwift themselves if they published one!
Blimey - is this the first time I've actually been in support of a Zwift policy decision?!